Overview

overview

10

Static

static

3

5c9488d078...bf.exe

windows7-x64

10

5c9488d078...bf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 22:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c9488d0782048e664fa5c251b6eb6ede980cbe6976707603bcbd8a05a5839bf.exe

  • Size

    351KB

  • MD5

    2533375af8ea823f0907866b1503fb23

  • SHA1

    715ff236b2b931f1950a1cc6fe5074c7a62345d3

  • SHA256

    5c9488d0782048e664fa5c251b6eb6ede980cbe6976707603bcbd8a05a5839bf

  • SHA512

    95a13ef81937dd08e8dc2ca6bdc69b6f883d85b290dd41b2c19557bdb9026f9841e35ffbf495fca82c51b0b5686bb118e903dcce4136291b2871d0d5bf140cc4

  • SSDEEP

    6144:V/OZpl7YZplx/OZpl7/OZplx/OZplQ/OZplU:V/M7qx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 36 IoCs
  • Drops file in Windows directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c9488d0782048e664fa5c251b6eb6ede980cbe6976707603bcbd8a05a5839bf.exe
    "C:\Users\Admin\AppData\Local\Temp\5c9488d0782048e664fa5c251b6eb6ede980cbe6976707603bcbd8a05a5839bf.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2124
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2648
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1368
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:956
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2964
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2480
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2596
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:816
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2040
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2368
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2944
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2336
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3056
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:576
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2220
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:236
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2292
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Modifies WinLogon
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • System policy modification
        PID:3040
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3012
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2360
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:828
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2284
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1732
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1680
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1084
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2224
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2656
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3004
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2820
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2308
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:984
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2972
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1000
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2664
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2104
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    d207e83dac3595d4b0b824aa776a60a6

    SHA1

    3c29bd1876167ba0976da8a10594b6aa0beeb9c8

    SHA256

    87d65d3d2f488bcb1dc6f82be570a6e8de8157e2cdd8d6c92fa911877ed47c49

    SHA512

    afab616c6a9648ebf38dce5d8ae7ffed23c28a40997860d1093453bf5ffe81588eeb5c8fd04807dcd6fae74d88a1d9b3303cb095e71fe7baa28fef927bd02e39

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    30dd761ee7a8cfb8018f6eb38a7544ac

    SHA1

    fb444afa51893d472fb90d8bd26e44d57eb05471

    SHA256

    d1b189768bce1bd5a8d8c629ca3f00ad77cee3762fa0f20b8d53d2816669c621

    SHA512

    8d70ac478d6e2eae0d0afce3b1e14c3a84b02222178eb7d4f6ed515b756f0e4c5a034bec5217ca14c088198d5e113259263f327682b6cc996d3d9642bd45da1b

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    1dd0bd3935fb5633feacb7dfc18f218c

    SHA1

    ebff07f7da2a14d9fde0495750d4a9615338ac65

    SHA256

    d84e280e4e68e6fefa273d9a8ceb40af74b58877786adb13f245290b4ef712da

    SHA512

    abe907a0297d2dc27f2c5a26abe73392aff9bac8b96bf89349f4b8cf99e2b50532facf03576a7995224ebdaad0c38abd0b16293c09e7475de8b78d3673dc4ed0

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    3da5b2e8466f89a2231f42325778cce8

    SHA1

    f90795e7254b711b533295cc98fcbbbe3b0e1b93

    SHA256

    e67007119e200c74876fc3756117c78c8c20de9c7abc9f27b7465b709d092643

    SHA512

    4476a8167da9c8cb18ff72a39323cdc411e58c1dfc662e9da989704e646d9ed0b96ee69b1f3d4382a21f6a46e59c099a8ca98c1152ee12218294cbd20da34488

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    dd1a0344e1bcb2b3f4783e434a422e93

    SHA1

    c1b5dc7326f34dd345c35ecfee8d870d6410246a

    SHA256

    e4adfce9204e0a7892cdab9654513ad7728bc65fea916abd9faed9b308f6d4f4

    SHA512

    b940e2b1a9a06492c3f925d3cc2ba55e8b40edc50812d2a9b747eaee8b17590ffe5cf37ba9f53fbac6476bf8a19181a07fb4581c1385ae68224ea4d06d3f8de1

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    55403db1b0607fc69dee35321a0d3673

    SHA1

    bf8f9509ef65e61f28bbf9da1f72e3b53045367c

    SHA256

    08ab5492b282edc6dcf7586068a0a5860e473849edf683e3b644a95f5fce1bbb

    SHA512

    0b26525b341bb15311f03221213ef0ca1642c70bdc2669dfd7ccba08bc4323a853879e540c66186c085bc4bf4bc20ab67617b41670cc12b19c040276821e5e55

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    0a7a57d0921becee16e4e3fa431dc8f5

    SHA1

    54d13231033651c56c05f38b954b1864260375c4

    SHA256

    05996b5507a5e39f31068b044fe72dc4abffc8f3377330a086b3de4fb343b970

    SHA512

    17278805572ac2dd75fb9f0df137f7379879adfc90089a96a2e3ee97797084abf7f7c679ccea8056a145284982fa7f2ccf945455a0a5cd49f2c47815151430e9

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    534c5a8832965d4060480109dc87d82c

    SHA1

    45f5563e8ac3fff0b7e0fac36e02cde90d1c866a

    SHA256

    23e0658ae6700eee7cdafe083d6b856d5b18cf6b54b89814ba88515b7fd7fd85

    SHA512

    01d0a50dd346820df10abb220b06becdcdb1d4c61964613ea57fd920835633a3be07388c64827c9178b69190383db7af3dc1b4e35d4b7413266e4ecc90f761ad

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    2b1a248cf5e2e52ef051d7831fce65f1

    SHA1

    50864c4244206861e8192db52629d501d48102c9

    SHA256

    03210ada9c08091f91a1cb64555bb8984d4e53e364232807dfa381e9121bb534

    SHA512

    ddde81d799ab5a58acd7fac1456e7a62f09051006d6af1add98101456549f40dd404758d46ed78e8370d6e3f0e333e8d1c03042315e76c3aac58917edfae1f43

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    d5f606c154dc2f72d41e0a2d329d4a4c

    SHA1

    92063036f8d6ed584498f2d1122700904cc074b2

    SHA256

    06845298d372ca34c4d9e179d96d472dbc0799bbbff24d37ca7db2991b844541

    SHA512

    a1c1d7ad403b72b6859a4f752ebb0107d792315d883f01722d9835b6552a100d34ed4a0d247abf1df20a2c68434917ba464778231ab37f35144e2b04fa445f09

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    97b78a1a5c24d86ff2a7edb9bae51203

    SHA1

    2d8d4a31192091ea1aaf30b2e1ebfe8759d42893

    SHA256

    54afbdda282928a9af77eb8836f9667f4bb5eb13b01686ad6e69406858710b38

    SHA512

    c9ebd06db8ad2c6933f7c3029439b34d8f5c5e8fc82cef99bfa13168f91fd88d2ac81785546e474110d88f50c73a5cb77b2b16d6969a8d337841b52ce42cc81e

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    e0998dddcc32668e41a19ac055fad998

    SHA1

    d7969ff007282abc51c02707f77a40aacb4dd004

    SHA256

    8db2f5d0343f66dfae3e9fc616138d4b2d720854f448d533a126d34e6442397f

    SHA512

    ba1fe3b9f04a8bf6ed84d6682092fee5f13e0d50ff57d6dd81da32b9bdf2d9e08fd19361f0d9ef0f6564a5abc8cbaaa9075bd1210ccbf624ced36448681b1692

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    1f86db3e7924e91b5a4f341cf811c2f4

    SHA1

    9dd58aa04af68586c906eb67dbe6b56a33b27fb9

    SHA256

    bc3245fbcffc7527f729996f419d4c26b694d356d9bab219961148bdb73e7d64

    SHA512

    cb59b9aa518290abb95c4bb2a87b1d956581ef88fd5e3ac6609213e39f89c2c6f0440f3d166595f8fa3711b6d320f47a07cd2b68a74e869a32061491c9bdb377

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    2533375af8ea823f0907866b1503fb23

    SHA1

    715ff236b2b931f1950a1cc6fe5074c7a62345d3

    SHA256

    5c9488d0782048e664fa5c251b6eb6ede980cbe6976707603bcbd8a05a5839bf

    SHA512

    95a13ef81937dd08e8dc2ca6bdc69b6f883d85b290dd41b2c19557bdb9026f9841e35ffbf495fca82c51b0b5686bb118e903dcce4136291b2871d0d5bf140cc4

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    d8587c76af0f0b45b27cbf1745d1487d

    SHA1

    f4386250f8fcc0811a1aedc810487a655aedd157

    SHA256

    73fbf2b8a1980cd2cf899d6869f78b63635ac6ba6701e3104108fd9551e6ba89

    SHA512

    ec18d16a04654c3f7a6b914f74189d5ebda23d9f8b6c301eb73f459fcf1a017285d0efae46c9f21758ef4867177b3a203e16401569c5be78c64d211cb631a638

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    a87071d62f8f16ae6500eda01d3c1b70

    SHA1

    af856be0e3c9c18546ba66704488705740969692

    SHA256

    7c369047d62d1ef8e514a744914c5636a04ffaf61851dd1d4362d1627493c512

    SHA512

    b0c5d25e62a3b63f5d9eb265d729b41a9ee58808f335cf7f620256b03283732f4c3743863f38c00a3ac4ea17f43d3ddef337fda6485ede3da57efdf95365c332

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    351KB

    MD5

    09e824e6c5c4700789bc7657c17c36d5

    SHA1

    f6209bfbd038b4b906f8e44e309ba121a8d36995

    SHA256

    86916a6b6ab1a36b3c08fd42c10c1b5c2ce53d596c3a8b91ec8f5e058c9209c6

    SHA512

    7eb35728ab834ccdca7b30a2169856a2981e16342eb3c52437b40a76baae2b862955ea0bb466bb3e376b7d3351f2abf64cb236013561c704abfb6eb68ac36381

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    5f278ad291751cc60b15dc855b6035ea

    SHA1

    1bc4f6abfa9061be2e05217d94863668667f8765

    SHA256

    919dbbafd1f2023bb6597a074acd2061fcf5d234cb5ed45387c54101e94de88e

    SHA512

    36bc102ca7ed64d14819a6783a20ae6787255a0433e8f4e189f9f8de30d90cddd96e8e38855fb5bc3f60f3a9db509c39c82dcee6c75bb1cb49415dc7271b4143

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    98a8f8707eb7ff6bf096bbfa10467081

    SHA1

    3aab90d9e66a02534a92d4c7764c51d4d9ce1e4e

    SHA256

    b083d6d3ceec406d5911892045c1786d4b1f372a8ac72578bf8441fc9d0e3b97

    SHA512

    fd64e9090877abe68ccbf6d100e8594a2c20a4cb6bea2a7584ed68d75342cb6195f673400b0eb980ad928a1ae34afb5f4ed3d40f18e272c1117fdcfd45ea98cb

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    351KB

    MD5

    c1d9dedb0e4ac896bedc423c93b2cf36

    SHA1

    bfd23bec10571a8ed63d8897a1374768384ef0a4

    SHA256

    8cb94035519bf05557b22ac712810dd77a1dc0e235544a47393e523278d46e42

    SHA512

    a9a58826e4485273dc6cb1c952cf5ef28547d021ae5b4d1f2442f31c0357978230d564fc6d5d1afc891b6d649a2540fb464d03c8825a0ada18153af6420796cb

    Download Submit

  • memory/816-412-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/816-111-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1368-215-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1368-225-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1368-220-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1680-230-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1680-229-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1680-167-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2040-297-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2124-232-0x0000000003930000-0x0000000003F2F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-234-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-99-0x0000000003830000-0x0000000003E2F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-110-0x0000000003830000-0x0000000003E2F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-425-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-165-0x0000000003930000-0x0000000003F2F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-235-0x0000000003830000-0x0000000003E2F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-166-0x0000000003930000-0x0000000003F2F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-228-0x0000000003930000-0x0000000003F2F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2124-98-0x0000000003830000-0x0000000003E2F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2368-303-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2368-302-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2648-100-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2648-291-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2648-231-0x00000000038D0000-0x0000000003ECF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2648-214-0x00000000038D0000-0x0000000003ECF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2648-233-0x00000000038D0000-0x0000000003ECF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2656-395-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3012-406-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3012-407-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3012-405-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3056-396-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3056-397-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3056-398-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download